- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1334/1334] kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace'
by kernel test robot 19 Jan '25

19 Jan '25

Hi Guilherme, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: 190aae97bcddbed131a203f829257b168f5058ce [1334/1334] kernel/hung_task.c: introduce sysctl to print all traces when a hung task is detected config: x86_64-randconfig-103-20241218 (https://download.01.org/0day-ci/archive/20250119/202501191953.ABToUtr4-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250119/202501191953.ABToUtr4-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501191953.ABToUtr4-lkp@intel.com/ All errors (new ones prefixed by >>): >> kernel/hung_task.c:148:7: error: use of undeclared identifier 'sysctl_hung_task_all_cpu_backtrace' 148 | if (sysctl_hung_task_all_cpu_backtrace) | ^ kernel/hung_task.c:235:5: warning: no previous prototype for function 'proc_dohung_task_timeout_secs' [-Wmissing-prototypes] 235 | int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, | ^ kernel/hung_task.c:235:1: note: declare 'static' if the function is not intended to be used outside of this translation unit 235 | int proc_dohung_task_timeout_secs(struct ctl_table *table, int write, | ^ | static 1 warning and 1 error generated. vim +/sysctl_hung_task_all_cpu_backtrace +148 kernel/hung_task.c 94 95 static void check_hung_task(struct task_struct *t, unsigned long timeout) 96 { 97 unsigned long switch_count = t->nvcsw + t->nivcsw; 98 99 /* 100 * Ensure the task is not frozen. 101 * Also, skip vfork and any other user process that freezer should skip. 102 */ 103 if (unlikely(t->flags & (PF_FROZEN | PF_FREEZER_SKIP))) 104 return; 105 106 /* 107 * When a freshly created task is scheduled once, changes its state to 108 * TASK_UNINTERRUPTIBLE without having ever been switched out once, it 109 * musn't be checked. 110 */ 111 if (unlikely(!switch_count)) 112 return; 113 114 if (switch_count != t->last_switch_count) { 115 t->last_switch_count = switch_count; 116 t->last_switch_time = jiffies; 117 return; 118 } 119 if (time_is_after_jiffies(t->last_switch_time + timeout * HZ)) 120 return; 121 122 trace_sched_process_hang(t); 123 124 if (sysctl_hung_task_panic) { 125 console_verbose(); 126 hung_task_show_lock = true; 127 hung_task_call_panic = true; 128 } 129 130 /* 131 * Ok, the task did not get scheduled for more than 2 minutes, 132 * complain: 133 */ 134 if (sysctl_hung_task_warnings) { 135 if (sysctl_hung_task_warnings > 0) 136 sysctl_hung_task_warnings--; 137 pr_err("INFO: task %s:%d blocked for more than %ld seconds.\n", 138 t->comm, t->pid, timeout); 139 pr_err(" %s %s %.*s\n", 140 print_tainted(), init_utsname()->release, 141 (int)strcspn(init_utsname()->version, " "), 142 init_utsname()->version); 143 pr_err("\"echo 0 > /proc/sys/kernel/hung_task_timeout_secs\"" 144 " disables this message.\n"); 145 sched_show_task(t); 146 hung_task_show_lock = true; 147 > 148 if (sysctl_hung_task_all_cpu_backtrace) 149 hung_task_show_all_bt = true; 150 } 151 152 touch_nmi_watchdog(); 153 } 154 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1327/1327] mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled'
by kernel test robot 19 Jan '25

19 Jan '25

Hi liubo, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: 44983705e56ab22fda801d66e2a6bd0d1be7ca0b [1327/1327] etmem: add original kernel swap enabled options config: x86_64-buildonly-randconfig-005-20241216 (https://download.01.org/0day-ci/archive/20250119/202501191820.CX3a1XfY-lkp@…) compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250119/202501191820.CX3a1XfY-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501191820.CX3a1XfY-lkp@intel.com/ All errors (new ones prefixed by >>): In file included from mm/vmscan.c:23: include/linux/pagemap.h:425:21: warning: cast from 'int (*)(struct file *, struct page *)' to 'filler_t *' (aka 'int (*)(void *, struct page *)') converts to incompatible function type [-Wcast-function-type-strict] 425 | filler_t *filler = (filler_t *)mapping->a_ops->readpage; | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ In file included from mm/vmscan.c:33: include/linux/mm_inline.h:32:41: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 32 | __mod_lruvec_state(lruvec, NR_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~ ^ ~~~ include/linux/mm_inline.h:34:22: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 34 | NR_ZONE_LRU_BASE + lru, nr_pages); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/vmscan.c:350:64: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 350 | lru_size = node_page_state(lruvec_pgdat(lruvec), NR_LRU_BASE + lru); | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:240:60: note: expanded from macro 'node_page_state' 240 | #define node_page_state(node, item) global_node_page_state(item) | ^~~~ mm/vmscan.c:363:29: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 363 | NR_ZONE_LRU_BASE + lru); | ~~~~~~~~~~~~~~~~ ^ ~~~ mm/vmscan.c:1776:4: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 1776 | __count_zid_vm_events(PGSCAN_SKIP, zid, nr_skipped[zid]); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:127:34: note: expanded from macro '__count_zid_vm_events' 127 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ mm/vmscan.c:2734:17: warning: variable 'node_lru_pages' set but not used [-Wunused-but-set-variable] 2734 | unsigned long node_lru_pages = 0; | ^ mm/vmscan.c:3066:3: warning: arithmetic between different enumeration types ('enum vm_event_item' and 'enum zone_type') [-Wenum-enum-conversion] 3066 | __count_zid_vm_events(ALLOCSTALL, sc->reclaim_idx, 1); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:127:34: note: expanded from macro '__count_zid_vm_events' 127 | __count_vm_events(item##_NORMAL - ZONE_NORMAL + zid, delta) | ~~~~~~~~~~~~~ ^ ~~~~~~~~~~~ >> mm/vmscan.c:3257:21: error: implicit declaration of function 'kernel_swap_enabled' [-Werror,-Wimplicit-function-declaration] 3257 | if (sc != NULL && !kernel_swap_enabled()) | ^ mm/vmscan.c:3257:21: note: did you mean 'kernfs_ns_enabled'? include/linux/kernfs.h:309:20: note: 'kernfs_ns_enabled' declared here 309 | static inline bool kernfs_ns_enabled(struct kernfs_node *kn) | ^ 8 warnings and 1 error generated. vim +/kernel_swap_enabled +3257 mm/vmscan.c 3250 3251 /* 3252 * Check if original kernel swap is enabled 3253 * turn off kernel swap,but leave page cache reclaim on 3254 */ 3255 static inline void kernel_swap_check(struct scan_control *sc) 3256 { > 3257 if (sc != NULL && !kernel_swap_enabled()) 3258 sc->may_swap = 0; 3259 } 3260 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1407/1407] hifc_lld.c:undefined reference to `rtc_time64_to_tm'
by kernel test robot 18 Jan '25

18 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: 7fc993d55d1b54ae40e29dfac825a18d04d644c6 [1407/1407] scsi/hifc: add hifc driver FC service module config: arm64-randconfig-003-20250116 (https://download.01.org/0day-ci/archive/20250118/202501182334.LzPZxncS-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250118/202501182334.LzPZxncS-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501182334.LzPZxncS-lkp@intel.com/ All errors (new ones prefixed by >>): aarch64-linux-ld: warning: -z norelro ignored aarch64-linux-ld: warning: .tmp_vmlinux1 has a LOAD segment with RWX permissions aarch64-linux-ld: drivers/scsi/huawei/hifc/hifc_lld.o: in function `hifc_sync_time_to_fmw': >> hifc_lld.c:(.text+0x4d4): undefined reference to `rtc_time64_to_tm' aarch64-linux-ld: drivers/scsi/huawei/hifc/hifc_dbgtool_knl.o: in function `ffm_intr_msg_record': >> hifc_dbgtool_knl.c:(.text+0x268): undefined reference to `rtc_time64_to_tm' -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1826/1826] include/linux/sched/signal.h: linux/kabi.h is included more than once.
by kernel test robot 18 Jan '25

18 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a5cbe5b715d9cac271b2c6175e728f0c4167f675 commit: b53643e68c841ccb6f05f90601ea30b1afeb0a2b [1826/1826] !3695 x86: Add x86 related kabi reservations compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501181428.cSbIc8DR-lkp@intel.com/ includecheck warnings: (new ones prefixed by >>) >> include/linux/sched/signal.h: linux/kabi.h is included more than once. vim +15 include/linux/sched/signal.h 4 5 #include <linux/rculist.h> 6 #include <linux/signal.h> 7 #include <linux/sched.h> 8 #include <linux/sched/jobctl.h> 9 #include <linux/sched/task.h> 10 #include <linux/cred.h> 11 #include <linux/refcount.h> 12 #include <linux/posix-timers.h> 13 #include <linux/mm_types.h> 14 #include <asm/ptrace.h> > 15 #include <linux/kabi.h> 16 > 17 #include <linux/kabi.h> 18 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] mm/slub: Reduce memory consumption in extreme scenarios
by Kaixiong Yu 18 Jan '25

18 Jan '25

From: Chen Jun <chenjun102(a)huawei.com> mainline inclusion from mainline-v6.10-rc1 commit 9198ffbd2b494daae3a67cac1d59c3a2754e64cd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBH72Q Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When kmalloc_node() is called without __GFP_THISNODE and the target node lacks sufficient memory, SLUB allocates a folio from a different node other than the requested node, instead of taking a partial slab from it. However, since the allocated folio does not belong to the requested node, on the following allocation it is deactivated and added to the partial slab list of the node it belongs to. This behavior can result in excessive memory usage when the requested node has insufficient memory, as SLUB will repeatedly allocate folios from other nodes without reusing the previously allocated ones. To prevent memory wastage, when a preferred node is indicated (not NUMA_NO_NODE) but without a prior __GFP_THISNODE constraint: 1) try to get a partial slab from target node only by having __GFP_THISNODE in pc.flags for get_partial() 2) if 1) failed, try to allocate a new slab from target node with GFP_NOWAIT | __GFP_THISNODE opportunistically. 3) if 2) failed, retry with original gfpflags which will allow get_partial() try partial lists of other nodes before potentially allocating new page from other nodes Without a preferred node, or with __GFP_THISNODE constraint, the behavior remains unchanged. On qemu with 4 numa nodes and each numa has 1G memory. Write a test ko to call kmalloc_node(196, GFP_KERNEL, 3) for (4 * 1024 + 4) * 1024 times. cat /proc/slabinfo shows: kmalloc-256 4200530 13519712 256 32 2 : tunables.. after this patch, cat /proc/slabinfo shows: kmalloc-256 4200558 4200768 256 32 2 : tunables.. Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Signed-off-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Vlastimil Babka <vbabka(a)suse.cz> Conflicts: mm/slub.c [The conflict is large. Because OLK-5.10 does not merge mainline patch 53a0de06e50acb372c75d87fcc72ddfdf4a060ee ("mm, slub: dissolve new_slab_objects() into ___slab_alloc()")] Signed-off-by: Kaixiong Yu <yukaixiong(a)huawei.com> --- mm/slub.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index 9dd4cc478ec3..de7edd49dcd9 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -2105,7 +2105,7 @@ static void *get_partial(struct kmem_cache *s, gfp_t flags, int node, searchnode = numa_mem_id(); object = get_partial_node(s, get_node(s, searchnode), c, flags); - if (object || node != NUMA_NO_NODE) + if (object || (node != NUMA_NO_NODE && (flags & __GFP_THISNODE))) return object; return get_any_partial(s, flags, c); @@ -2687,6 +2687,8 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node, { void *freelist; struct page *page; + bool try_thisnode = true; + gfp_t thisnode_gfpflags; stat(s, ALLOC_SLOWPATH); @@ -2764,9 +2766,33 @@ static void *___slab_alloc(struct kmem_cache *s, gfp_t gfpflags, int node, goto redo; } - freelist = new_slab_objects(s, gfpflags, node, &c); +new_objects: + + thisnode_gfpflags = gfpflags; + /* + * When a preferred node is indicated but no __GFP_THISNODE + * + * 1) try to get a partial slab from target node only by having + * __GFP_THISNODE in thisnode_gfpflags for new_slab_objects() + * 2) if 1) failed, try to allocate a new slab from target node with + * GPF_NOWAIT | __GFP_THISNODE opportunistically + * 3) if 2) failed, retry with original gfpflags which will allow + * new_slab_objects() try partial lists of other nodes before potentially + * allocating new page from other nodes + */ + if (unlikely(node != NUMA_NO_NODE && !(gfpflags & __GFP_THISNODE) + && try_thisnode)) + thisnode_gfpflags = GFP_NOWAIT | __GFP_THISNODE; + + freelist = new_slab_objects(s, thisnode_gfpflags, node, &c); if (unlikely(!freelist)) { + if (node != NUMA_NO_NODE && !(gfpflags & __GFP_THISNODE) + && try_thisnode) { + try_thisnode = false; + goto new_objects; + } + slab_out_of_memory(s, gfpflags, node); return NULL; } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ceph: prevent use-after-free in encode_cap_msg()
by Long Li 18 Jan '25

18 Jan '25

From: Rishabh Dave <ridave(a)redhat.com> stable inclusion from stable-v5.15.148 commit 70e329b440762390258a6fe8c0de93c9fdd56c77 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9E2GN CVE: CVE-2024-26689 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit cda4672da1c26835dcbd7aec2bfed954eda9b5ef upstream. In fs/ceph/caps.c, in encode_cap_msg(), "use after free" error was caught by KASAN at this line - 'ceph_buffer_get(arg->xattr_buf);'. This implies before the refcount could be increment here, it was freed. In same file, in "handle_cap_grant()" refcount is decremented by this line - 'ceph_buffer_put(ci->i_xattrs.blob);'. It appears that a race occurred and resource was freed by the latter line before the former line could increment it. encode_cap_msg() is called by __send_cap() and __send_cap() is called by ceph_check_caps() after calling __prep_cap(). __prep_cap() is where arg->xattr_buf is assigned to ci->i_xattrs.blob. This is the spot where the refcount must be increased to prevent "use after free" error. Cc: stable(a)vger.kernel.org Link: https://tracker.ceph.com/issues/59259 Signed-off-by: Rishabh Dave <ridave(a)redhat.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Reviewed-by: Xiubo Li <xiubli(a)redhat.com> Signed-off-by: Ilya Dryomov <idryomov(a)gmail.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/ceph/caps.c [__send_cap() has been refacaored] Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ceph/caps.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c index 1cc433de4200..b631719941c2 100644 --- a/fs/ceph/caps.c +++ b/fs/ceph/caps.c @@ -1347,7 +1347,7 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap, if (flushing & CEPH_CAP_XATTR_EXCL) { old_blob = __ceph_build_xattrs_blob(ci); arg.xattr_version = ci->i_xattrs.version; - arg.xattr_buf = ci->i_xattrs.blob; + arg.xattr_buf = ceph_buffer_get(ci->i_xattrs.blob); } else { arg.xattr_buf = NULL; } @@ -1387,6 +1387,7 @@ static int __send_cap(struct ceph_mds_client *mdsc, struct ceph_cap *cap, dout("error sending cap msg, must requeue %p\n", inode); delayed = 1; } + ceph_buffer_put(arg.xattr_buf); if (wake) wake_up_all(&ci->i_cap_wq); -- 2.39.2

2 1

[PATCH OLK-5.10] [Backport] btrfs: flush delalloc workers queue before stopping cleaner kthread during unmount
by Yongjian Sun 18 Jan '25

18 Jan '25

From: Filipe Manana <fdmanana(a)suse.com> mainline inclusion from mainline-v6.12-rc3 commit f10bef73fb355e3fc85e63a50386798be68ff486 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBIAEJ CVE: CVE-2024-57896 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- During the unmount path, at close_ctree(), we first stop the cleaner kthread, using kthread_stop() which frees the associated task_struct, and then stop and destroy all the work queues. However after we stopped the cleaner we may still have a worker from the delalloc_workers queue running inode.c:submit_compressed_extents(), which calls btrfs_add_delayed_iput(), which in turn tries to wake up the cleaner kthread - which was already destroyed before, resulting in a use-after-free on the task_struct. Syzbot reported this with the following stack traces: BUG: KASAN: slab-use-after-free in __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089 Read of size 8 at addr ffff8880259d2818 by task kworker/u8:3/52 CPU: 1 UID: 0 PID: 52 Comm: kworker/u8:3 Not tainted 6.13.0-rc1-syzkaller-00002-gcdd30ebb1b9f #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: btrfs-delalloc btrfs_work_helper Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 __lock_acquire+0x78/0x2100 kernel/locking/lockdep.c:5089 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162 class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:551 [inline] try_to_wake_up+0xc2/0x1470 kernel/sched/core.c:4205 submit_compressed_extents+0xdf/0x16e0 fs/btrfs/inode.c:1615 run_ordered_work fs/btrfs/async-thread.c:288 [inline] btrfs_work_helper+0x96f/0xc40 fs/btrfs/async-thread.c:324 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 </TASK> Allocated by task 2: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4104 [inline] slab_alloc_node mm/slub.c:4153 [inline] kmem_cache_alloc_node_noprof+0x1d9/0x380 mm/slub.c:4205 alloc_task_struct_node kernel/fork.c:180 [inline] dup_task_struct+0x57/0x8c0 kernel/fork.c:1113 copy_process+0x5d1/0x3d50 kernel/fork.c:2225 kernel_clone+0x223/0x870 kernel/fork.c:2807 kernel_thread+0x1bc/0x240 kernel/fork.c:2869 create_kthread kernel/kthread.c:412 [inline] kthreadd+0x60d/0x810 kernel/kthread.c:767 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Freed by task 24: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2338 [inline] slab_free mm/slub.c:4598 [inline] kmem_cache_free+0x195/0x410 mm/slub.c:4700 put_task_struct include/linux/sched/task.h:144 [inline] delayed_put_task_struct+0x125/0x300 kernel/exit.c:227 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:943 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544 __call_rcu_common kernel/rcu/tree.c:3086 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:3190 context_switch kernel/sched/core.c:5372 [inline] __schedule+0x1803/0x4be0 kernel/sched/core.c:6756 __schedule_loop kernel/sched/core.c:6833 [inline] schedule+0x14b/0x320 kernel/sched/core.c:6848 schedule_timeout+0xb0/0x290 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common kernel/sched/completion.c:116 [inline] wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion+0x355/0x620 kernel/sched/completion.c:148 kthread_stop+0x19e/0x640 kernel/kthread.c:712 close_ctree+0x524/0xd60 fs/btrfs/disk-io.c:4328 generic_shutdown_super+0x139/0x2d0 fs/super.c:642 kill_anon_super+0x3b/0x70 fs/super.c:1237 btrfs_kill_super+0x41/0x50 fs/btrfs/super.c:2112 deactivate_locked_super+0xc4/0x130 fs/super.c:473 cleanup_mnt+0x41f/0x4b0 fs/namespace.c:1373 task_work_run+0x24f/0x310 kernel/task_work.c:239 ptrace_notify+0x2d2/0x380 kernel/signal.c:2503 ptrace_report_syscall include/linux/ptrace.h:415 [inline] ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline] syscall_exit_work+0xc7/0x1d0 kernel/entry/common.c:173 syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline] syscall_exit_to_user_mode+0x24a/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff8880259d1e00 which belongs to the cache task_struct of size 7424 The buggy address is located 2584 bytes inside of freed 7424-byte region [ffff8880259d1e00, ffff8880259d3b00) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x259d0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff88802f4b56c1 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801bafe500 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000040004 00000001f5000000 ffff88802f4b56c1 head: 00fff00000000040 ffff88801bafe500 dead000000000100 dead000000000122 head: 0000000000000000 0000000000040004 00000001f5000000 ffff88802f4b56c1 head: 00fff00000000003 ffffea0000967401 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 12, tgid 12 (kworker/u8:1), ts 7328037942, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556 prep_new_page mm/page_alloc.c:1564 [inline] get_page_from_freelist+0x3651/0x37a0 mm/page_alloc.c:3474 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 alloc_slab_page+0x6a/0x140 mm/slub.c:2408 allocate_slab+0x5a/0x2f0 mm/slub.c:2574 new_slab mm/slub.c:2627 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3815 __slab_alloc+0x58/0xa0 mm/slub.c:3905 __slab_alloc_node mm/slub.c:3980 [inline] slab_alloc_node mm/slub.c:4141 [inline] kmem_cache_alloc_node_noprof+0x269/0x380 mm/slub.c:4205 alloc_task_struct_node kernel/fork.c:180 [inline] dup_task_struct+0x57/0x8c0 kernel/fork.c:1113 copy_process+0x5d1/0x3d50 kernel/fork.c:2225 kernel_clone+0x223/0x870 kernel/fork.c:2807 user_mode_thread+0x132/0x1a0 kernel/fork.c:2885 call_usermodehelper_exec_work+0x5c/0x230 kernel/umh.c:171 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 page_owner free stack trace missing Memory state around the buggy address: ffff8880259d2700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880259d2780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880259d2800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880259d2880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880259d2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Fix this by flushing the delalloc workers queue before stopping the cleaner kthread. Reported-by: syzbot+b7cf50a0c173770dcb14(a)syzkaller.appspotmail.com Link: https://lore.kernel.org/linux-btrfs/674ed7e8.050a0220.48a03.0031.GAE@google… Reviewed-by: Qu Wenruo <wqu(a)suse.com> Signed-off-by: Filipe Manana <fdmanana(a)suse.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Signed-off-by: Yongjian Sun <sunyongjian1(a)huawei.com> --- fs/btrfs/disk-io.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c index 5e42f339fa83..b364fa3806ec 100644 --- a/fs/btrfs/disk-io.c +++ b/fs/btrfs/disk-io.c @@ -4151,6 +4151,15 @@ void __cold close_ctree(struct btrfs_fs_info *fs_info) * already the cleaner, but below we run all pending delayed iputs. */ btrfs_flush_workqueue(fs_info->fixup_workers); + /* + * Similar case here, we have to wait for delalloc workers before we + * proceed below and stop the cleaner kthread, otherwise we trigger a + * use-after-tree on the cleaner kthread task_struct when a delalloc + * worker running submit_compressed_extents() adds a delayed iput, which + * does a wake up on the cleaner kthread, which was already freed below + * when we call kthread_stop(). + */ + btrfs_flush_workqueue(fs_info->delalloc_workers); /* * After we parked the cleaner kthread, ordered extents may have -- 2.39.2

2 1

[openeuler:OLK-6.6 1826/1826] drivers/irqchip/irq-gic-v3.c:1036:23: error: call to undeclared function 'pde_data'; ISO C99 and later do not support implicit function declarations
by kernel test robot 18 Jan '25

18 Jan '25

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a5cbe5b715d9cac271b2c6175e728f0c4167f675 commit: 3053668e6b211924bb67c19d791a5a532eca2ad8 [1826/1826] arm64: Introduce Xint software solution config: arm64-randconfig-r123-20250118 (https://download.01.org/0day-ci/archive/20250118/202501180931.eG4TBbkV-lkp@…) compiler: clang version 15.0.7 (https://github.com/llvm/llvm-project 8dfdcc7b7bf66834a761bd8de445840ef68e4d1a) reproduce: (https://download.01.org/0day-ci/archive/20250118/202501180931.eG4TBbkV-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501180931.eG4TBbkV-lkp@intel.com/ All errors (new ones prefixed by >>): >> drivers/irqchip/irq-gic-v3.c:1036:23: error: call to undeclared function 'pde_data'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] int irq = (int)(long)pde_data(file_inode(file)); ^ drivers/irqchip/irq-gic-v3.c:1074:2: error: call to undeclared function 'seq_printf'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] seq_printf(m, "%d\n", xint_transform((long)m->private, XINT_SET_CHECK)); ^ drivers/irqchip/irq-gic-v3.c:1074:46: error: incomplete definition of type 'struct seq_file' seq_printf(m, "%d\n", xint_transform((long)m->private, XINT_SET_CHECK)); ~^ arch/arm64/include/asm/smp.h:56:8: note: forward declaration of 'struct seq_file' struct seq_file; ^ drivers/irqchip/irq-gic-v3.c:1080:9: error: call to undeclared function 'single_open'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] return single_open(file, xint_proc_show, pde_data(inode)); ^ drivers/irqchip/irq-gic-v3.c:1080:9: note: did you mean 'simple_open'? include/linux/fs.h:3226:12: note: 'simple_open' declared here extern int simple_open(struct inode *inode, struct file *file); ^ drivers/irqchip/irq-gic-v3.c:1080:43: error: call to undeclared function 'pde_data'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] return single_open(file, xint_proc_show, pde_data(inode)); ^ drivers/irqchip/irq-gic-v3.c:1085:15: error: use of undeclared identifier 'seq_read' .proc_read = seq_read, ^ drivers/irqchip/irq-gic-v3.c:1086:16: error: use of undeclared identifier 'seq_lseek' .proc_lseek = seq_lseek, ^ drivers/irqchip/irq-gic-v3.c:1087:18: error: use of undeclared identifier 'single_release' .proc_release = single_release, ^ drivers/irqchip/irq-gic-v3.c:1083:30: error: variable has incomplete type 'const struct proc_ops' static const struct proc_ops xint_proc_ops = { ^ drivers/irqchip/irq-gic-v3.c:1083:21: note: forward declaration of 'struct proc_ops' static const struct proc_ops xint_proc_ops = { ^ >> drivers/irqchip/irq-gic-v3.c:1097:2: error: call to undeclared function 'proc_create_data'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] proc_create_data("xint", 0644, desc->dir, &xint_proc_ops, irqp); ^ >> drivers/irqchip/irq-gic-v3.c:1105:2: error: call to undeclared function 'remove_proc_entry'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] remove_proc_entry("xint", desc->dir); ^ 11 errors generated. vim +/pde_data +1036 drivers/irqchip/irq-gic-v3.c 1032 1033 static ssize_t xint_proc_write(struct file *file, 1034 const char __user *buffer, size_t count, loff_t *pos) 1035 { > 1036 int irq = (int)(long)pde_data(file_inode(file)); 1037 bool xint_state = false; 1038 unsigned long val; 1039 char *buf = NULL; 1040 1041 if (!xint_transform(irq, XINT_RANGE_CHECK)) 1042 return -EPERM; 1043 1044 buf = memdup_user_nul(buffer, count); 1045 if (IS_ERR(buf)) 1046 return PTR_ERR(buf); 1047 1048 if (kstrtoul(buf, 0, &val) || (val != 0 && val != 1)) { 1049 kfree(buf); 1050 return -EINVAL; 1051 } 1052 1053 xint_state = xint_transform(irq, XINT_SET_CHECK); 1054 if (xint_state == val) { 1055 kfree(buf); 1056 return -EBUSY; 1057 } 1058 1059 local_irq_disable(); 1060 disable_irq(irq); 1061 1062 xint_transform(irq, xint_state ? XINT_TO_IRQ : IRQ_TO_XINT); 1063 1064 enable_irq(irq); 1065 local_irq_enable(); 1066 1067 kfree(buf); 1068 1069 return count; 1070 } 1071 1072 static int xint_proc_show(struct seq_file *m, void *v) 1073 { 1074 seq_printf(m, "%d\n", xint_transform((long)m->private, XINT_SET_CHECK)); 1075 return 0; 1076 } 1077 1078 static int xint_proc_open(struct inode *inode, struct file *file) 1079 { 1080 return single_open(file, xint_proc_show, pde_data(inode)); 1081 } 1082 > 1083 static const struct proc_ops xint_proc_ops = { 1084 .proc_open = xint_proc_open, 1085 .proc_read = seq_read, 1086 .proc_lseek = seq_lseek, > 1087 .proc_release = single_release, 1088 .proc_write = xint_proc_write, 1089 }; 1090 1091 void register_irqchip_proc(struct irq_desc *desc, void *irqp) 1092 { 1093 if (!is_xint_support) 1094 return; 1095 1096 /* create /proc/irq/<irq>/xint */ > 1097 proc_create_data("xint", 0644, desc->dir, &xint_proc_ops, irqp); 1098 } 1099 1100 void unregister_irqchip_proc(struct irq_desc *desc) 1101 { 1102 if (!is_xint_support) 1103 return; 1104 > 1105 remove_proc_entry("xint", desc->dir); 1106 } 1107 #endif /* CONFIG_FAST_IRQ */ 1108 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:OLK-6.6 1826/1826] mm/page_alloc.c:4110:9: error: call to undeclared function 'dynamic_pool_should_alloc'; ISO C99 and later do not support implicit function declarations
by kernel test robot 18 Jan '25

18 Jan '25

Hi Liu, FYI, the error/warning still remains. tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: a5cbe5b715d9cac271b2c6175e728f0c4167f675 commit: fd855715f24e3eeadaa56de5fde21c55a14aeea0 [1826/1826] mm/mem_reliable: Fallback to dpool if reliable memory is not enough config: arm64-randconfig-r123-20250118 (https://download.01.org/0day-ci/archive/20250118/202501180715.zDIl6KOU-lkp@…) compiler: clang version 15.0.7 (https://github.com/llvm/llvm-project 8dfdcc7b7bf66834a761bd8de445840ef68e4d1a) reproduce: (https://download.01.org/0day-ci/archive/20250118/202501180715.zDIl6KOU-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501180715.zDIl6KOU-lkp@intel.com/ All errors (new ones prefixed by >>): >> mm/page_alloc.c:4110:9: error: call to undeclared function 'dynamic_pool_should_alloc'; ISO C99 and later do not support implicit function declarations [-Werror,-Wimplicit-function-declaration] return dynamic_pool_should_alloc(gfp_mask & ~GFP_RELIABLE, order); ^ 1 error generated. vim +/dynamic_pool_should_alloc +4110 mm/page_alloc.c 4101 4102 static inline bool mem_reliable_fallback_dpool(gfp_t gfp_mask, unsigned int order) 4103 { 4104 if (!reliable_allow_fb_enabled()) 4105 return false; 4106 4107 if (!(gfp_mask & GFP_RELIABLE)) 4108 return false; 4109 > 4110 return dynamic_pool_should_alloc(gfp_mask & ~GFP_RELIABLE, order); 4111 } 4112 #else 4113 static inline struct zone *mem_reliable_fallback_zone(gfp_t gfp_mask, 4114 struct alloc_context *ac) 4115 { 4116 return NULL; 4117 } 4118 static inline void mem_reliable_fallback_slowpath(gfp_t gfp_mask, 4119 struct alloc_context *ac) {} 4120 static inline bool mem_reliable_fallback_dpool(gfp_t gfp_mask, unsigned int order) 4121 { 4122 return false; 4123 } 4124 #endif 4125 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1407/1407] include/linux/kernel.h:851:43: warning: comparison of distinct pointer types lacks a cast
by kernel test robot 18 Jan '25

18 Jan '25

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: 52349611d09c6a9a2b558b3ce1cb1dca0d47dbe8 commit: 7ad207616673722d5cf52c18d9464e0d3184ffc9 [1407/1407] arp: Prevent overflow in arp_req_get(). config: x86_64-defconfig (https://download.01.org/0day-ci/archive/20250118/202501180701.f6sYgGum-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250118/202501180701.f6sYgGum-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202501180701.f6sYgGum-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from include/linux/list.h:9, from include/linux/module.h:10, from net/ipv4/arp.c:78: net/ipv4/arp.c: In function 'arp_req_get': >> include/linux/kernel.h:851:43: warning: comparison of distinct pointer types lacks a cast 851 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ^~ include/linux/kernel.h:865:18: note: in expansion of macro '__typecheck' 865 | (__typecheck(x, y) && __no_side_effects(x, y)) | ^~~~~~~~~~~ include/linux/kernel.h:875:31: note: in expansion of macro '__safe_cmp' 875 | __builtin_choose_expr(__safe_cmp(x, y), \ | ^~~~~~~~~~ include/linux/kernel.h:884:25: note: in expansion of macro '__careful_cmp' 884 | #define min(x, y) __careful_cmp(x, y, <) | ^~~~~~~~~~~~~ net/ipv4/arp.c:1106:33: note: in expansion of macro 'min' 1106 | min(dev->addr_len, sizeof(r->arp_ha.sa_data))); | ^~~ net/ipv4/arp.o: warning: objtool: missing symbol for section .init.text vim +851 include/linux/kernel.h 526211bc58c4b3 Ingo Molnar 2009-03-05 837 ^1da177e4c3f41 Linus Torvalds 2005-04-16 838 /* 3c8ba0d61d04ce Kees Cook 2018-03-30 839 * min()/max()/clamp() macros must accomplish three things: 3c8ba0d61d04ce Kees Cook 2018-03-30 840 * 3c8ba0d61d04ce Kees Cook 2018-03-30 841 * - avoid multiple evaluations of the arguments (so side-effects like 3c8ba0d61d04ce Kees Cook 2018-03-30 842 * "x++" happen only once) when non-constant. 3c8ba0d61d04ce Kees Cook 2018-03-30 843 * - perform strict type-checking (to generate warnings instead of 3c8ba0d61d04ce Kees Cook 2018-03-30 844 * nasty runtime surprises). See the "unnecessary" pointer comparison 3c8ba0d61d04ce Kees Cook 2018-03-30 845 * in __typecheck(). 3c8ba0d61d04ce Kees Cook 2018-03-30 846 * - retain result as a constant expressions when called with only 3c8ba0d61d04ce Kees Cook 2018-03-30 847 * constant expressions (to avoid tripping VLA warnings in stack 3c8ba0d61d04ce Kees Cook 2018-03-30 848 * allocation usage). 3c8ba0d61d04ce Kees Cook 2018-03-30 849 */ 3c8ba0d61d04ce Kees Cook 2018-03-30 850 #define __typecheck(x, y) \ 3c8ba0d61d04ce Kees Cook 2018-03-30 @851 (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) 3c8ba0d61d04ce Kees Cook 2018-03-30 852 :::::: The code at line 851 was first introduced by commit :::::: 3c8ba0d61d04ced9f8d9ff93977995a9e4e96e91 kernel.h: Retain constant expression output for max()/min() :::::: TO: Kees Cook <keescook(a)chromium.org> :::::: CC: Linus Torvalds <torvalds(a)linux-foundation.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0